5.5 AWS PrivateLink and Endpoint Services

Quick Answer: AWS PrivateLink gives private connectivity to AWS services and your own applications through interface endpoints — Elastic Network Interfaces (ENIs) with private IPs placed in your subnet. It needs no VPC peering, Internet Gateway, NAT, or VPN. Connectivity is unidirectional (consumer → provider) and works even when CIDRs overlap. Gateway endpoints are a separate, free mechanism for S3 and DynamoDB only.

Interface Endpoints vs. Gateway Endpoints

This distinction is heavily tested. PrivateLink powers interface endpoints; gateway endpoints are a different (and free) feature.

On the Exam: "Private S3 access with no cost" → Gateway endpoint. "Private access to SQS, Kinesis, or Secrets Manager" → Interface endpoint (PrivateLink). "Reach S3 privately from on-premises over Direct Connect" → interface endpoint, because gateway endpoints are VPC-local only.

Endpoint Services — Exposing Your Own Application

PrivateLink also lets you publish your own service to other VPCs and accounts.

Provider side:

1. Put the service behind a Network Load Balancer (NLB) — PrivateLink requires an NLB target.
2. Create a VPC Endpoint Service that points to the NLB.
3. Approve connection requests (manually or via an allow-list of principals).

Consumer side:

1. Create an interface VPC endpoint targeting the provider's endpoint service.
2. An ENI with a private IP appears in the consumer's subnet.
3. The application connects to that private IP — traffic never touches the public internet.

PrivateLink vs. VPC Peering

Because traffic terminates on an ENI rather than being routed between VPC CIDRs, overlapping address ranges are fine — a decisive advantage when onboarding many customers whose VPCs all use 10.0.0.0/16.

On the Exam: "Expose an internal API to hundreds of customer VPCs without peering or shared CIDR planning" → PrivateLink endpoint service + NLB. "Allow private, one-way access where the provider must never reach back into the consumer" → PrivateLink (peering would be bidirectional).

Private Access to AWS Services and Cost Reasoning

A classic exam pattern: an EC2 instance in a fully private subnet (no NAT, no IGW) must call AWS APIs such as SSM, Secrets Manager, Kinesis, or ECR. The answer is an interface endpoint (PrivateLink) for that service, which keeps the API traffic on the AWS network with no internet path. For Amazon S3 or DynamoDB specifically, prefer a gateway endpoint because it is free, whereas interface endpoints bill per hour and per GB.

There is also a cost-optimization angle. Routing S3 traffic through a NAT Gateway incurs NAT per-GB data-processing charges on top of the NAT gateway's hourly charge; sending that S3 traffic through an S3 gateway endpoint removes the data-processing charge for it (the NAT gateway's hourly charge continues while it stays provisioned for other traffic). When a scenario stresses "reduce NAT data-processing costs for S3 access," the gateway endpoint is the intended answer.

Decision Summary

Common Traps

• Gateway endpoint for everything: gateway endpoints serve only S3 and DynamoDB. Any other service requires an interface endpoint.
• Cross-Region S3 through a gateway endpoint: a gateway endpoint serves S3 or DynamoDB only in its own Region. Traffic to the service in a different Region still goes to the internet gateway (or NAT path), because prefix lists are Region-specific.
• PrivateLink is bidirectional: it is not — consumers initiate to the provider; the provider cannot reach back. If the scenario needs two-way traffic, that is peering or Transit Gateway.
• Endpoint service behind an ALB: PrivateLink endpoint services require a Network Load Balancer, not an Application Load Balancer.
• CIDR conflicts block PrivateLink: they do not — because no inter-VPC routing occurs, overlapping CIDRs are fine, which is the headline advantage over peering.

DNS, Security, and Cross-Account Sharing

Interface endpoints come with a per-endpoint DNS name, but enabling private DNS on the endpoint overrides the service's public hostname (for example sqs.us-east-1.amazonaws.com) so existing application code resolves to the private endpoint IP with no code change — a detail the exam rewards. Because each interface endpoint is just an ENI, you secure it with a security group, restricting which subnets or instances may reach the service. You can also attach a VPC endpoint policy (a resource-style IAM policy) to limit which principals and actions the endpoint permits, useful for locking an S3 gateway endpoint to specific buckets.

For exposing your own service, the endpoint service can auto-accept requests from an allow-list of account or IAM principals, enabling controlled cross-account SaaS delivery. When a question contrasts PrivateLink with a public path, the deciding factors are usually that PrivateLink keeps traffic off the internet, scales to thousands of consumers, and sidesteps CIDR coordination — none of which a public, IP-allow-listed endpoint can match.